Book a walkthrough
Cyber Essentials

See your Cyber Essentials readiness all year round.

A live verdict and a pre-filled submission workbook end the annual scramble for evidence.

It is often the first proof customers and insurers ask for, and part of the Governance evidence behind your critical business services.

Book a 30-minute walkthrough Download
CYBER ESSENTIALS READINESS NOT ASSESSED : 5 controls · 3 pass · 1 at risk · 1 not assessed CONTROL SUMMARY Firewalls A4 PASS host firewalls on every host checked Secure configuration A5 NOT ASSESSED 38 hosts unreachable: credential rejected User access control A7 PASS Identity rules evaluated Malware protection A8 PASS anti-malware active on devices checked Security update mgmt A6 AT RISK late Windows patches flagged Submission workbook: Pre-filled answers Evidence sheets Coverage badges Illustrative. A coverage gap holds a control at Not assessed. A real failure stays failed. Submission workbook built Green means checked. Every status gives its reason.
In the console

Your position, control by control

Each Cyber Essentials control shows pass, fail or not assessed, with the reason drawn from your estate and how to fix it.

Example console view.
See what’s there

A live verdict replaces the annual evidence scramble

Annual preparation tells you where you stood on the day. Rebasoft keeps your status current with each collection, supported by identity rules, host checks and TLS rules, and the dashboard, PDF and CSV all agree.

Firewalls

Host firewall status read directly from each Windows and Linux machine, which replaces screenshots.

Secure configuration

Agentless host checks across Windows, Linux and Intune, with expected and observed values side by side.

User access

Identity rules surface dormant administrators, MFA gaps and stale guests before your assessor asks.

Malware protection

Active protection recognised from Defender or a third-party product, with signature freshness through Intune.

Security updates

Vulnerabilities, end-of-life software and late Windows patches in the same verdict, so there is one status to manage.

TLS and certificates

Rules catch expired and expiring certificates, old protocols, weak ciphers and short keys before they cause a problem.

Submission workbook

Around half of the questionnaire arrives pre-filled from collected data

A blank self-assessment means a long round of chasing. This workbook follows the IASME v3.3 question set and includes evidence sheets, so your team spends its time on the questions that need its judgement. Your team submits it, and certification stays with your certification body.

Pre-filled
Less to research

Questions on scope, patching, access and malware protection are populated from collected data, which saves your team the chase.

Evidence
Answers you can stand behind

Each row links to a detail sheet, with a coverage badge showing how the answer was derived.

Guided
Less to repeat next year

A guided wizard handles organisation, scope, policy and network boundary questions, and keeps the history for your next renewal.

Evidence you can rely on

Green means checked

Self-assessment invites optimism, and a verdict built on partial evidence helps nobody at renewal. A control passes when its evidence is complete and current. Otherwise Rebasoft reports Not assessed with the reason, so gaps surface well before your assessor sees them.

Patching412 of 412 devices checked
Pass
Malware protection3 devices with no protection
Fail
Secure configuration38 devices unreachable: credential rejected
Not assessed
Illustrative example
A renewal in practice

Renewal becomes a review, in place of a project

  1. Six weeks out

    The IT manager reviews her site

    She opens Cyber Essentials for her site and sees the status of each control, with the reasons behind it. Two controls need attention.

  2. That day

    The organisational questions are completed

    Fill in manual answers opens a wizard over the IASME questions and shows how many remain.

  3. That week

    Policy is attached to the question

    She starts a patch policy from a template and attaches it to A6, where it remains available for next year’s renewal.

  4. Next week

    Remediation is confirmed

    Her team addresses the failures with its existing tools, and the next collection confirms the changes.

  5. Renewal

    The workbook is ready for review

    She runs Cyber Essentials Submission and receives one row per question, with the derived answer, a coverage badge and a link to a detail sheet. A2.6, for example, links to the live device list. She reviews the workbook and submits it through her certification body.

A composite example based on product behaviour.

FAQ
Does Rebasoft fill in the self-assessment?
Around half of the questionnaire arrives pre-filled from collected data, and a guided wizard takes your team through the remainder. Your team reviews a finished workbook in place of a blank form.
Does it prepare us for Cyber Essentials Plus?
Yes. You arrive with the same verdict, checks and evidence already in hand. Your assessor carries out the testing, and certification stays with your certification body.
What does setup involve?
Setup is simple: credentials for the hosts and directories in scope, and the vulnerability licence on which the Cyber Essentials view runs. There are no endpoint agents to deploy.
Can an MSP deliver this for its customers?
Yes. Each customer has its own Rebasoft deployment, which keeps its data separate, and reports run on a per-site schedule, so the service repeats without extra effort. See MSP services.
Does this help with other standards?
Yes. Cyber Essentials is the natural first step towards ISO 27001 and NIST CSF, because their technical controls overlap. The evidence Rebasoft collects gives those programmes a head start. See compliance evidence.

More questions? See the full Rebasoft FAQ — answers by topic and by role, or how Rebasoft is priced.

Further reading

From the blog

All cyber essentials & compliance articles →See it in practice: UK retail co-operative →
Top MSP Compliance Services for Real Assurance
Cyber Essentials & compliance 19 Oct 2026

Top MSP Compliance Services for Real Assurance

Top MSP compliance services should deliver continuous evidence, clearer priorities and audit-ready reporting - without adding operational overhead at all.

Read article
What Is Continuous Compliance Monitoring?
Cyber Essentials & compliance 5 Oct 2026

What Is Continuous Compliance Monitoring?

What is continuous compliance monitoring? See how control evidence, risk prioritisation and service context reduce audit effort and strengthen assurance.

Read article
Audit Evidence Automation That Stands Up to Scrutiny
Cyber Essentials & compliance 1 Oct 2026

Audit Evidence Automation That Stands Up to Scrutiny

Audit evidence automation replaces last-minute evidence hunts with continuous, traceable proof of control performance, risk and business impact clearly.

Read article

See Cyber Essentials on a live console

In thirty minutes, see the verdict, the submission workbook and how much of your next renewal is already done.

Book a 30-minute walkthrough See compliance evidence